ci: align helm-publish job with hriv reference pattern

[devin-ai-integration]

Summary

Aligns the ci.yaml helm-publish job with the hriv reference implementation and the updated sugar-suite pattern. Changes:

1. Step ordering: Moved Cosign installer + login before the push step (was after). All tools are now set up before any publishing happens.
2. Combined push + sign: Merged the separate "Package and push" / "Sign chart" steps into a single Package, push & sign chart step (matching hriv).
3. if condition simplified: Changed from github.event_name != 'pull_request' && rc_version != '' to just github.event_name != 'pull_request', with the version emptiness check handled inside the script (graceful exit 0). This matches hriv's approach and avoids potential issues with undefined output references.
4. Dynamic chart name: Uses awk to read name: from Chart.yaml instead of hardcoding tech-ops-docs in both ci.yaml and helm-publish.yaml.

No functional behavior change — the chart still publishes the same OCI artifact with the same RC version on main push.

Review & Testing Checklist for Human

• Verify the helm-publish job still runs successfully on a main push after merge
• Confirm the chart OCI artifact appears at ghcr.io/bcit-tlu/technical-operations-documentation/charts/tech-ops-docs with the expected RC version

Notes

Both ci.yaml and helm-publish.yaml now use consistent dynamic chart name resolution via awk.

Link to Devin session: https://app.devin.ai/sessions/b416bd270b364a028c5aa5d1b3bafa9d
Requested by: @kphunter

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring